[field type tracking] Fix handling of cleared WeakCells

src/accessors.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/accessors.h"
 
 #include "src/api.h"
 #include "src/contexts.h"
 #include "src/deoptimizer.h"
 #include "src/execution.h"
@@ skipping 992 matching lines @@
 }
 
 
 MUST_USE_RESULT static MaybeHandle<Object> ReplaceAccessorWithDataProperty(
     Isolate* isolate, Handle<JSObject> object, Handle<Name> name,
     Handle<Object> value, bool is_observed, Handle<Object> old_value) {
   LookupIterator it(object, name);
   CHECK_EQ(LookupIterator::ACCESSOR, it.state());
   DCHECK(it.HolderIsReceiverOrHiddenPrototype());
   it.ReconfigureDataProperty(value, it.property_details().attributes());
-  it.WriteDataValue(value);
 
   if (is_observed && !old_value->SameValue(*value)) {
     return JSObject::EnqueueChangeRecord(object, "update", name, old_value);
   }
 
   return value;
 }
 
 
 MUST_USE_RESULT static MaybeHandle<Object> SetFunctionLength(
@@ skipping 479 matching lines @@
   Handle<Object> getter = v8::FromCData(isolate, &ModuleGetExport);
   Handle<Object> setter = v8::FromCData(isolate, &ModuleSetExport);
   info->set_getter(*getter);
   if (!(attributes & ReadOnly)) info->set_setter(*setter);
   return info;
 }
 
 
 }  // namespace internal
 }  // namespace v8